CVE-2026-87538: Clickjacking in Google Chrome

This vulnerability involves clickjacking in the input handling of Google Chrome versions before 153.0.8010.36. An attacker with control over the renderer process can craft HTML pages that spoof UI elements, potentially tricking users. The issue requires prior compromise of the renderer process and social engineering to be effective. The Chromium security team rates this vulnerability as low severity. No CVSS score is provided. The vendor advisory link points to a stable channel update, implying a fix may be included in or after version 153.0.8010.36.

The impact is limited to UI spoofing via clickjacking after an attacker has already compromised the renderer process. This could mislead users into performing unintended actions. The severity is low, indicating limited risk and no direct remote code execution or privilege escalation solely from this vulnerability.

The vendor advisory linked suggests that the issue is addressed in Chrome version 153.0.8010.36. Users should update to this version or later to remediate the vulnerability. Since no explicit remediation level or patchAvailable flag is given, check the vendor advisory for confirmation. No additional mitigation actions are indicated.